Children's body busted for email, file cabinet blunders The Information Commissioner's Office (ICO) has found that the organisation which investigates the care of Scotland's most vulnerable children had twice failed to protect sensitive child welfare information. In January 2011 the Scottish Children's Reporter Administration (SCRA) sent legal papers containing sensitive …
They sent legal documents including "details relating to physical abuse and included the identities of the child's mother and witnesses" by email?
In the UK? A country where Phorm, Vodafone, Bluecoat, BT, Yahoo, Experian Hitwise, Huawei, TalkTalk are criminally and illegally intercepting private/confidential unencrypted telecommunications?
That in itself ought to be grounds for a switft belt around the head with a LART.
> In the UK? A country where Phorm, Vodafone, Bluecoat, BT, Yahoo, Experian
> Hitwise, Huawei, TalkTalk are criminally and illegally intercepting
> private/confidential unencrypted telecommunications?
The problem is more about using unencrypted email; sending DPA-protected information over external networks via unencrypted email is a breach in itself[1].
But email *can* be secure - if you're sending it point-to-point between trusted MTAs, you can encrypt at the transport layer. this is the default condition for many mail servers (including the ones I set up).
But if they're sending to the wrong bloody address, it's pretty clear that such security is not in place. Someone needs a beasting...
Vic.
[1] Not that the ICO will ever do anything about it, of course.
...whats the alternative?
Courier? So what if they loose it, happend before.
Fax? Wrong Number (plus could eb 500 pages long)?
Letter? Well two words, Royal Mail?
Someone drive there? Great all we need is serveral hundred more staff to do this one function.
Direct ftp? To every courthouse and solicitors in the country?
So come on then...whats the great answer oh wise one?
Yes because there were clearly no transfer of legal documents before email was invented so none of those options are credible.....
It's a question of duty of care - if you use a courier, or *registered* mail (or recorded delivery) then you have exercised reasonable care in transporting sensitive material. If you elect to transfer the material yourself through the use of unencrypted email and have no checks in place to confirm you are sending to the correct address then you have *not* demonstrated a reasonable duty of care.
Well they could try sending it to the correct address for a start. I don't think it unreasonable to expect people to make sure that they are using the correct information expecially when it involves a legal matter.
However, there are other options - a collaborative space on a server that someone could gain access to using a 2 factor authentication is one that immediately springs to mind. Encryption also seems reasonable. Both easily set-up and managed.
However, I would also state that no system is ever 100% proof - the human factor is always the weakest link and I would accept that things do go wrong. But the real issue is that these public bodies seem to wring their hands, create "new" policies and then do nothing to actually fix the main underlying issue; which is that people do really stupid things.
You would have thought that all the recent and high profile publicity surrounding these sorts of muckups would have made them take extra care. Just goes to show that you can set up all the policies you want, but if you employ monkeys, they will fling peanuts and poop all over the place!
The problem with SCRA is that they barely employ anyone anymore; among admin staff they have a 50% vacancy plan and are in the middle of a significant reorganisation. They dont use the GMPS markings for their material and most of it goes by Royal Mail, albeit in sealed bags that the posties must know contains all sorts.
Why not Zip it up with password protection (AES 256-bit) then talk to the recipient by phone and tell them the password. If it's important (of course it is) then it's worth putting a little bit of extra time and effort into it. (I realise that this needs staff at both ends who 'know about computers')
I've had the joy or trying to explain to another organisation why we couldn't just e-mail them some sensitive information. They couldn't apparently deal with encrypted files as for 'security reasons' they could only deal with Microsoft DOC format and anything else couldn't be received. Had a nice interview with my boss about being 'uncooperative' on that one.
I then had the joy of explaining to his boss, when I was covering for him going on holiday, that he shouldn't be sending sensitive files to my home e-mail address so I could follow-up on some work. Another nice interview where I had to explain the difference between our internal e-mail system and what could happen when you send sensitive material outside it's protection.
Unless data protection is hard wired into communications systems it will always fail under the demands of ignorant managers.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
